by Kastro
Paper/Archive/CVE-2023-41920

CVE-2023-41920

Kiloview P1/P2 — Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.5.365 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.

Affected

ProductAffectedFixed inSource
P1/P2All – 4.8.2605–CNA
p1_4g_video_encoder_firmware≤ *–CISA-ADP
p2_4g_video_encoder_firmware≤ *–CISA-ADP

Scores by source

NCSC-NL (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refadvisories.ncsc.nl/advisory?id=NCSC-2024-0273